<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.threads.AbstractThreadCheck : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.m.t.AbstractThreadCheck(<span title="object">object</span>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.threads.html">threads</a></span>
      
      <a href="classIndex.html#volatility.plugins.malware.threads.AbstractThreadCheck">View In Hierarchy</a>
    </p>
    <div>
      <p>Known subclasses: <a href="volatility.plugins.malware.threads.AttachedProcess.html">volatility.plugins.malware.threads.AttachedProcess</a>, <a href="volatility.plugins.malware.threads.DkomExit.html">volatility.plugins.malware.threads.DkomExit</a>, <a href="volatility.plugins.malware.threads.HideFromDebug.html">volatility.plugins.malware.threads.HideFromDebug</a>, <a href="volatility.plugins.malware.threads.HookedSSDT.html">volatility.plugins.malware.threads.HookedSSDT</a>, <a href="volatility.plugins.malware.threads.HwBreakpoint.html">volatility.plugins.malware.threads.HwBreakpoint</a>, <a href="volatility.plugins.malware.threads.Impersonation.html">volatility.plugins.malware.threads.Impersonation</a>, <a href="volatility.plugins.malware.threads.OrphanThread.html">volatility.plugins.malware.threads.OrphanThread</a>, <a href="volatility.plugins.malware.threads.ScannerOnly.html">volatility.plugins.malware.threads.ScannerOnly</a>, <a href="volatility.plugins.malware.threads.SystemThread.html">volatility.plugins.malware.threads.SystemThread</a></p>
    </div>
    <div>Base thread check class<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id181">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.threads.AbstractThreadCheck.html#__init__">__init__</a></td>
    <td><span>&#64;param thread: the _ETHREAD object</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.threads.AbstractThreadCheck.html#check">check</a></td>
    <td><span>Return True or False from this method</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.malware.threads.AbstractThreadCheck.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, thread, mods, mod_addrs, hooked_tables, found_by_scanner):
    
  </div>
  <div class="functionBody">
    
    <div>&#64;param thread: the _ETHREAD object</p>
<p>&#64;param mods: a dictionary with module bases as
keys and _LDR_DATA_TABLE_ENTRY as values.</p>
<p>&#64;param mod_addrs: a sorted list of module base
addresses</p>
<p>&#64;param hooked_tables: a list of SSDTs that have
one or more hooked functions.</p>
<p>&#64;param found_by_scanner: True/False if the _ETHREAD
passed as the thread parameter was found via
list walking or pool scanning.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.threads.AbstractThreadCheck.check">
    
  </a>
  <a name="check">
    
  </a>
  <div class="functionHeader">
    
    def
    check(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overridden in <a href="volatility.plugins.malware.threads.AttachedProcess.html">volatility.plugins.malware.threads.AttachedProcess</a>, <a href="volatility.plugins.malware.threads.DkomExit.html">volatility.plugins.malware.threads.DkomExit</a>, <a href="volatility.plugins.malware.threads.HideFromDebug.html">volatility.plugins.malware.threads.HideFromDebug</a>, <a href="volatility.plugins.malware.threads.HookedSSDT.html">volatility.plugins.malware.threads.HookedSSDT</a>, <a href="volatility.plugins.malware.threads.HwBreakpoint.html">volatility.plugins.malware.threads.HwBreakpoint</a>, <a href="volatility.plugins.malware.threads.Impersonation.html">volatility.plugins.malware.threads.Impersonation</a>, <a href="volatility.plugins.malware.threads.OrphanThread.html">volatility.plugins.malware.threads.OrphanThread</a>, <a href="volatility.plugins.malware.threads.ScannerOnly.html">volatility.plugins.malware.threads.ScannerOnly</a>, <a href="volatility.plugins.malware.threads.SystemThread.html">volatility.plugins.malware.threads.SystemThread</a></div>
    <div>Return True or False from this method<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>